Empire 6.0 – New Agents, Plugin Marketplace, and Major Updates

Empire 6.0 is finally here with tons of new updates and features. The team has been working on this for about a year now and we are really excited to show off all the changes. We have added new agents, revamped our compilers, and added an all-new marketplace for plugins. Before we dive into these exciting additions, let’s discuss one of the other big changes: the deprecation and removal of the Empire Client.

The client was the first interface that Empire was published with, so it’s with a bit of sadness that we say goodbye to it. Unfortunately, maintaining and updating the client has become too much of a development overhead with many of the new Empire features over the past few years. That, combined with the added workload of maintaining it alongside Starkiller, made it the right decision for the long-term support of the project.

For the diehards out there, the good news is that the terminal in Starkiller is no longer in beta and still provides a command-line-like interface for agent interaction.

The Plugin Marketplace

Empire has supported plugins for a long time now, with multiple iterations and expanded capabilities, the most recent being the introduction of filters and hooks. However, there hasn’t been a great place for users to see what plugins are available or install the plugins they wanted to use.

More importantly, it couldn’t be done from within Starkiller, which made the workflow very clunky, especially for server deployments.

As of Empire 6.0, that problem is now solved with the new in-built Plugin Marketplace. Users can browse and install plugins directly within Starkiller and utilize them without restarting the server.

By default, Starkiller points to the BC Security Empire Plugin Registry, but it also supports private registries for those who want to build in-house plugins or maintain their own marketplaces.

This configuration lives in the server config.yaml, just add an entry for any additional registries you’d like to use.

We hope this makes workflows easier for operators and encourages community development for more plugins. If you develop a cool plugin, submit it to us as a pull request for the registry, we’ll vet it, and if approved, it will appear in the registry, so everyone can natively access your hard work.

Go Agents Are Now Available in Empire

When we first took over the Empire Framework, we said one of our goals was to provide a long-term project reflecting real-world TTPs used by APTs, and threat emulation would always be at the core.

We’ve continued to expand Empire into C#, IronPython, and integrated BOFs, giving Empire immense flexibility for emulation.

But threat actors continue to evolve, and unmanaged code continues to play a bigger role in their TTPs. So, it was time for Empire to support an unmanaged agent.

Go agents are now operational in Empire! Cx01N spent the better part of the past year building and testing the new agent.

The agent supports all current modules in Empire, giving it full flexibility for any threat you’re emulating.

C# Compiler Revamp

Going forward, the server will now be distributed as a pre-compiled executable. Prior to 6.0, Empire required the .NET SDK to be installed to support C# operations. This added unnecessary overhead in both disk space and install time, and could cause instability if other tools on the host machine conflicted with the SDK.

The new approach removes that dependency entirely, reducing setup time and improving reliability.

Other Changes

In addition to the major features above, Empire 6.0 includes a variety of quality-of-life improvements:

• The -f flag is now available to force Empire to install as root. While running as non-root remains the recommended configuration for better security posture, red team environments sometimes make this necessary (e.g., Raspberry Pi jump boxes).
• A new allow/deny list implementation supports IPv4, IPv6, ranges, and CIDRs, significantly improving usability.
• The Sharphound ingestor for Bloodhound CE has been added (with the original Bloodhound tagged as legacy).
• MITRE ATT&CK tagging has been updated for all modules.
• The RunOF C# module has been replaced by COFFLoader for improved stability and compatibility.
• Autoruns are back, now accessible via a dedicated tab in Starkiller’s Listener page.

For a complete list of all changes, check out the changelog.

Parting Thoughts

Empire 6.0 represents a major leap forward in operational capability, ensuring it remains an accessible and relevant framework for offensive security operators.

We’re looking forward to community contributions to the new Plugin Marketplace and continuing to push improvements — stay tuned for more updates soon!